Chapter 4: Managing Local Users, Groups, and Devices

If you want to log on to Windows 10, you must have a user account. With this user account, the user can access resources on the local computer or on network computers, such as file servers. User accounts are, in most cases, members of a local group. Giving file access rights to a local group is much easier than giving access rights to individual user accounts.

The following topics will be covered in this chapter:

• Managing local users
• Managing local groups
• Managing devices

In this chapter, you will learn about the differences between authentication and authorization. You will learn about the various logon accounts and how you can customize them. This is important as users need to have access to data that is stored on file servers and on other network connected devices. We will focus on how to manage Windows 10 devices in Azure Active Directory (Azure AD) and how to manage local users and local groups.

...

Technical requirements

This chapter will use PowerShell code. This code is available in this book's GitHub repository at https://github.com/PacktPublishing/Microsoft-Exam-MD-100-Windows-10-Certification-Guide/tree/master/Chapter04.

In the Managing devices section, you will learn about joining and registering devices in Azure AD. The steps that you will follow have also been recorded. You can find the videos for these here: https://bit.ly/2LsQDqD

Managing local users

In this section, we will look at the local users in Windows 10. If you have experience with an earlier edition of Windows, you might be familiar with configuring local users since this has remained unchanged over the years.

Before you log into Windows 10, you must create a user account during the initial setup. There are three types of accounts you can use to do this:

• Local account
• Domain account
• Microsoft account

In this chapter, we will focus on the local account, because this will appear in the MD-100 exam.

As described previously, a user account is required to log on in Windows 10. To secure it, the user account should have a password. While installing Windows 10, user accounts that are automatically created. We will look at this shortly.

Configuring local accounts

As the name suggests, a local user account resides on the local device only. It does not allow a user to access resources on other Windows 10 computers. Typically...

Managing local groups

In the previous section, you learned that there are built-in local user accounts. There are also a few built-in local groups in Windows 10 that provide users with an easier way to delegate the same permissions and rights as other group members. Assigning permissions to groups is much more efficient than applying these rights to individual user accounts.

If you open the Users group or the Administrators group, then you should see members that you recognize. Administrators have complete and unrestricted access to the computer. Users are unable to make system-wide changes, but they can run most applications that have already been installed on the computer.

Default local groups

In the Groups folder, which you can find in the Computer Management console, you can create local groups, change group memberships, rename groups, and delete groups. Microsoft's best practice is to use the default local groups wherever possible. The built-in groups already have...

Managing devices

Windows 10 was designed to be managed using cloud-based tools such as Microsoft Intune and Microsoft Endpoint Manager. Nowadays, more businesses are moving away from on-premises domain environments to the cloud.

In this section, you will learn how to register a device in Azure AD with a work or school account using cloud-based services. We will also look at how to enable device registration and the process of joining devices to Azure AD.

Azure AD is Microsoft's cloud-based identity authentication and access management authorization service that enables your users to benefit from Single Sign-On (SSO) for cloud-based applications, such as Microsoft Office 365 and many other Software as a Service (SaaS) applications. Azure AD join also enables Windows Hello, as well as access to the Microsoft Store for Business. Users can easily join their devices to your organization's Azure AD tenant.

When joining devices to an on-premises domain environment, the...

Summary

You have learned a lot in this chapter, including the difference between the three sorts of user accounts that can be logged into with Windows 10. In addition to that, you learned know how to create, modify, and delete local user accounts via Computer Management and PowerShell.

You saw which user accounts are created during the initial setup of Windows 10. We also covered local groups in this chapter, and you learned how to create, modify, delete, and rename local groups via Computer Management or PowerShell. As well as doing this, you are now familiar with which built-in local groups are created during the installation of Windows 10 and where these local users and local groups are stored on a computer. This will help you understand how you can administer local users and local groups.

Furthermore, we covered how to manage Windows 10 devices via Azure AD. Here, you configured Azure AD so that users can enroll their Windows 10, Android, or iOS devices into Azure AD. You...

Questions

1. Can you fully manage a registered Windows 10 device in Azure Active Directory?
2. Is the local Administrator account enabled by default?
3. Can you register a smartphone to Azure Active Directory?
4. What is the correct PowerShell cmdlet to use to create a new local group?

Further reading

• What is Azure Active Directory?: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
• Azure AD registered devices: https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register
• Azure AD joined devices: https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join
• What is a device identity?: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory/devices/overview.md?